"GDPR Says Yes"

The wishes, needs and priorities set out in TLAP's Data for People and the Money Advice Trust's Ten Principles have a striking amount in common.

The theme that gets the most coverage in both, with seven statements across the two sources, is that data should be focused on the person. 

This is followed by inclusion and accessibility (four statements), transparency and accountability (three statements) choice and control (three statements), and ethics (three statements).

Between them, the two sources also offer an additional five specific statements which stand alone.

Here's a full breakdown:

Person-centred data

Statements focusing on the fact that data is about people, and that has to remain at the centre of everything that is done with it.  As one participant in TLAP's research said, "Data has soul".

TLAP 1:  Approaches to data should be co-produced with people who draw on care and support, and family and friend carers.

TLAP 2:  The primary purpose of data in care and support must be to improve people’s lives, in line with established policy including the wellbeing principle.

TLAP 4:  The data collected around individuals’ care and support should relate to the things that matter to them.

TLAP 5:  People who draw on care and support must define the outcomes against which care and support provision is assessed.

MAT 3:  This is not a technical project (keep the focus on solving the human problem).

MAT 4:  ‘Actionable support needs’ are the key (rather than higher-level flags alone).

MAT 7:  Consumer data-sharing portals should lead to support (accessible and timely).

Inclusion and accessibility

Accessibility is an obvious theme given the needs of many of the people involved.  This theme also reflects the importance of aggregate data representing the whole population.

TLAP 3:  The data we collect must be used to drive equity and inclusion.

TLAP 6:  Datasets on care and support must be inclusive of everyone who draws on care and support, of family and friend carers and of the range of different models of care.

TLAP 10:  People should have access to their own data, in formats that are accessible and appropriate for them.

MAT 6:  Consumer data-sharing portals must be accessible (a key test of our values).

Transparency and accountability

TLAP 13:  Data collection, storage, sharing and use should be regularly audited to ensure that systems and processes are of high quality, to eliminate any bias or inequity, and to ensure all protocols are being followed.

TLAP 14:  Organisations using care and support data should be transparent in their activities and accountable for its use.

MAT 8:  Organisations will use shared data differently (transparency is therefore vital).

Choice and control

This theme covers what may be the most important issue to tackle: ownership. (See comments below.)

TLAP 8:  Data about individuals’ care and support belongs to them – people need choice and control over how their data is collected, used and shared, even when it is shared anonymously, and options to opt out of data sharing if they choose.

TLAP 12:  People should be able to verify and update their own data, using simple mechanisms.

MAT 5:  Consumers want to feel in control (even if some decide to never exercise this).

Ethics

TLAP 9:  Individuals’ data should not be sold for profit or used to generate revenue without their explicit consent.

TLAP 15:  People must have access to mechanisms for recourse if their data is mishandled, falsified, or shared inappropriately.

MAT 10:  Meet current need, watch for future harm (avoid unintended consequences).

(TLAP 13 also belongs here.)

Standalone statements

Narrative and qualitative data.  TLAP 7:  Personal stories and statements and other qualitative data should be valued alongside quantitative data.

Friend and family carers.  TLAP 11:  Family and friend carers should be able to access data around the people to whom they provide care and support, where consent has been given and with appropriate safeguards.

Vocabulary.  MAT 1:  speak the same language (define ‘data-sharing’, ‘disclosure’, ‘vulnerability’).

Willingness to share.  MAT 2:  data-sharing needs data (so avoid the known barriers to consumer disclosure).

Lawful basis.  MAT 9:  every organisation in a sharing network does not need to use the same lawful processing [basis] under the Data Protection Act (2018) for recording and sharing data.

Other observations

1. Despite the parallels, the most obvious difference between the two sources is context.  MAT's document is about information which originates with people, which they choose to share with institutions in order to get the service and support they need. TLAP's document is about health and care data, much (most?) of which originates with professionals - indeed, TLAP 7 is effectively a plea to professionals to pay attention to the information people want to share.

2. TLAP 7's emphasis on personal stories, narrative and other qualitative data is a well recognised issue within health and care.  I discuss this in more detail elsewhere on this site, particularly the frustrating lack of usage of existing resources such as About Me. Equally, there's a recognised imbalance between health and care in terms of structured and qualitative data; NHS data is more rigorously structured whereas care data can me more narrative.  Both are needed.

3. TLAP 11's reference to family and friend carers is an important point.  Current systems will capture formal appointeeships and powers of attorney, but are extremely poor at capturing the informal arrangements which are crucial to many people's lives.  Proxy arrangements take many forms, with different legal bases, powers and duties, but even these don't account for "You have my ongoing consent to talk to my daughter about my [gas account, prescriptions, benefits claim, whatever] "- which too often turns into a frustrated daughter on the phone to a contact centre, saying "You have my mum's permission to talk to me saved in your records...".  Any effort to tackle this will obviously need to take account of an informal proxy/representative overstepping the boundaries of what they've been asked to do on a person's behalf.

4. Two of the three examples of vocabulary in MAT 1 - disclosure and vulnerability - have a different meaning in health and social care speak -an extremely negative meaning which may generate a known obstacle to information sharing. We do need to ensure that terms are clearly understood and don't unwittingly convey a negative impression, particularly as the conversation extends across sectoral boundaries.

5. TLAP acknowledges need for data to cover all parts of the community including minorities, but also suggests some people from minoritised communities will want to opt out for fear of being identifiable.  This carries a serious risk of skewing the overall data and making minorities' needs and wishes even less visible.

6. TLAP document implies a belief that consent is required for all cases of data sharing. GDPR Art. 6 (e) and 9 (2) make it clear that this isn't always the case.  GDPR-compliant consent is simply too cumbersome for the urgent needs around health and care (or emergency services) data sharing - see PFD reports.  But TLAP's statement that "data sharing requires trust – that data will be shared safely and appropriately. At present, people have real concerns about how their data is being shared, which is leading to mistrust" (p10) is entirely valid and needs to be given due weight alongside the alternative lawful bases to consent.  

7. It would be interesting to know more about the "information gleaned from the media, or as a result of being involved in previous consultative or participative exercises, about changes to data collection, storage, sharing and usage at national or local level" (TLAP, p5).  The document references both Client Level Data (CLD) and the federated platform contract recently awarded to Palantir as causing concern, but there is also a more generic negtaive message about data sharing in the current debate, driven by alarmist agendas and conspiracy theories rather than by fact.  I'll pick this up under "Next Steps".

8. The theme of consent and choice raises the question of ownership of data. TLAP 8 makes it clear that people drawing on care and support see their data as belonging to them; there are several references throughout the report to people having the right to opt out (highlighted in green in this annotated copy). It's not always that straightforward, though - the National Data Guardian's report on barriers to information sharing states (p18) "… we query the use of the term 'own' data. From a legal perspective, an individual cannot 'own' individual data or their records”.  Again, I'll pick this up under "Consent or public task?" and "Next Steps".

[Items in italics still in mid-draft. To be continued...]

TLAP's six priorities for action are critical to the resolution of these issues.  In particular, the first two priorities - around co-production and the need for properly established mechanisms to ensure it - offer a much needed starting-point for a constructive, collaborative, inclusive approach to data sharing.  Priority 4 refers to "communicating people's rights clearly", which needs to include communication about situations where consent to share data is not required (see Consent or public task?)